A retail company has built several backend microservices that expose data to internal teams and a few external partners. Leadership is concerned about inconsistent security enforcement, no visibility into which teams call which services, and difficulty enforcing rate limits across the different APIs. They want a single layer to manage, secure, and monitor all of their APIs without rewriting the backends. Which Google Cloud product should they adopt?